@open-mercato/ai-assistant 0.6.5-develop.5337.1.534b781eac → 0.6.5

package/src/modules/ai_assistant/lib/generated-registry-loader.ts

@@ -95,6 +95,38 @@ export async function compileAndImportGenerated(tsPath: string): Promise<Record<
   return (await import(pathToFileURL(jsPath).href)) as Record<string, unknown>
 }
 
+const UNSAFE_JS_STRING_CHAR_ESCAPES: Record<number, string> = {
+  0x3c: '\\u003C', // <  — HTML/script-tag breakout
+  0x3e: '\\u003E', // >  — HTML/script-tag breakout
+  0x2028: '\\u2028', // line separator — string content but a statement terminator pre-ES2019
+  0x2029: '\\u2029', // paragraph separator — same
+}
+
+/**
+ * Escape characters that `JSON.stringify` leaves intact but which can still
+ * break out of (or alter the meaning of) the JavaScript string literal that the
+ * stringified value is embedded into — notably `<`/`>` (HTML/script-tag
+ * breakout) and the U+2028 / U+2029 line separators (valid string content but
+ * statement terminators in pre-ES2019 parsers). Apply this on top of
+ * `JSON.stringify` so the emitted import source stays well-formed regardless of
+ * the resolved path. Exported for unit testing.
+ */
+export function escapeUnsafeJsStringChars(value: string): string {
+  return value.replace(
+    /[<>\u2028\u2029]/g,
+    (char) => UNSAFE_JS_STRING_CHAR_ESCAPES[char.charCodeAt(0)],
+  )
+}
+
+/**
+ * Stringify a resolved path into a JavaScript string literal that is safe to
+ * embed in generated source: `JSON.stringify` handles quoting/standard escapes,
+ * and `escapeUnsafeJsStringChars` neutralizes the characters it leaves intact.
+ */
+function toSafeJsStringLiteral(value: string): string {
+  return escapeUnsafeJsStringChars(JSON.stringify(value))
+}
+
 /**
  * Rewrite `@/...` path-alias imports (both `from "@/x"` and dynamic
  * `import("@/x")`) in generated-registry source to absolute `file://` URLs
@@ -110,14 +142,14 @@ export function rewriteGeneratedAliasImports(source: string, appRoot: string): s
       : fs.existsSync(target + '.ts')
         ? target + '.ts'
         : target
-    return pathToFileURL(candidate).href
+    return toSafeJsStringLiteral(pathToFileURL(candidate).href)
   }
   return source
     .replace(/from\s+["']@\/([^"']+)["']/g, (_match, relativePath: string) => {
-      return `from ${JSON.stringify(resolveAlias(relativePath))}`
+      return `from ${resolveAlias(relativePath)}`
     })
     .replace(/import\s*\(\s*["']@\/([^"']+)["']\s*\)/g, (_match, relativePath: string) => {
-      return `import(${JSON.stringify(resolveAlias(relativePath))})`
+      return `import(${resolveAlias(relativePath)})`
     })
 }
 

package/src/modules/ai_assistant/lib/llm-adapters/anthropic.ts

@@ -6,7 +6,7 @@
  * a curated model list for the AI Assistant UI dropdown.
  *
  * @see packages/shared/src/lib/ai/llm-provider.ts
- * @see .ai/specs/2026-04-14-llm-provider-ports-and-adapters.md
+ * @see .ai/specs/implemented/2026-04-14-llm-provider-ports-and-adapters.md
  */
 
 import { createAnthropic } from '@ai-sdk/anthropic'

package/src/modules/ai_assistant/lib/llm-adapters/google.ts

@@ -5,7 +5,7 @@
  * Wraps `createGoogleGenerativeAI({ apiKey })` from `@ai-sdk/google`.
  *
  * @see packages/shared/src/lib/ai/llm-provider.ts
- * @see .ai/specs/2026-04-14-llm-provider-ports-and-adapters.md
+ * @see .ai/specs/implemented/2026-04-14-llm-provider-ports-and-adapters.md
  */
 
 import { createGoogleGenerativeAI } from '@ai-sdk/google'

package/src/modules/ai_assistant/lib/llm-adapters/openai.ts

@@ -14,7 +14,7 @@
  *
  * @see packages/shared/src/lib/ai/llm-provider.ts
  * @see ./openai-compatible-presets.ts
- * @see .ai/specs/2026-04-14-llm-provider-ports-and-adapters.md
+ * @see .ai/specs/implemented/2026-04-14-llm-provider-ports-and-adapters.md
  */
 
 import { createOpenAI } from '@ai-sdk/openai'

package/src/modules/ai_assistant/lib/llm-bootstrap.ts

@@ -11,7 +11,7 @@
  * `console.warn` but leaves the rest of the registry working.
  *
  * @see packages/shared/src/lib/ai/llm-provider-registry.ts
- * @see .ai/specs/2026-04-14-llm-provider-ports-and-adapters.md
+ * @see .ai/specs/implemented/2026-04-14-llm-provider-ports-and-adapters.md
  */
 
 import { llmProviderRegistry } from '@open-mercato/shared/lib/ai/llm-provider-registry'

package/src/modules/ai_assistant/lib/mcp-client.ts

@@ -8,11 +8,15 @@ import type { McpClientInterface, ToolInfo, ToolResult } from './types'
  */
 export type StdioClientOptions = {
   transport: 'stdio'
-  /** API key secret (passed to server via --api-key) */
+  /**
+   * API key secret. Delivered to the spawned server via the
+   * `OPEN_MERCATO_API_KEY` environment variable, never as a command-line
+   * argument (argv is world-readable via `ps`/`/proc/<pid>/cmdline`).
+   */
   apiKeySecret: string
   /** Command to run (default: 'yarn') */
   command?: string
-  /** Arguments for the command (default: mercato mcp:serve with api-key) */
+  /** Arguments for the command (default: mercato ai_assistant mcp:serve, no secret on argv) */
   args?: string[]
   /** Working directory (default: process.cwd()) */
   cwd?: string
@@ -72,12 +76,12 @@ export class McpClient implements McpClientInterface {
    */
   private static async connectStdio(options: StdioClientOptions): Promise<McpClient> {
     const command = options.command ?? 'yarn'
+    // The API key is passed via OPEN_MERCATO_API_KEY in the child env (below),
+    // never on argv — command-line arguments are readable by any local user.
     const args = options.args ?? [
       'mercato',
       'ai_assistant',
       'mcp:serve',
-      '--api-key',
-      options.apiKeySecret,
     ]
     const cwd = options.cwd ?? process.cwd()
 
@@ -85,7 +89,7 @@ export class McpClient implements McpClientInterface {
       command,
       args,
       cwd,
-      env: process.env as Record<string, string>,
+      env: { ...process.env, OPEN_MERCATO_API_KEY: options.apiKeySecret } as Record<string, string>,
       stderr: 'pipe',
     })
     transport.stderr?.on('data', (data) => {

package/src/modules/ai_assistant/lib/mcp-dev-key-resolution.ts

@@ -0,0 +1,107 @@
+import { resolve, dirname } from 'node:path'
+
+const MCP_CONFIG_FILENAME = '.mcp.json'
+
+// Markers that identify a project/repo root. The lookup stops at the first
+// ancestor that has one of these, so the secret is only ever read from the
+// project root — never from an unbounded walk up to the filesystem root.
+const PROJECT_ROOT_MARKERS = ['.git', 'yarn.lock', 'pnpm-lock.yaml', 'package-lock.json'] as const
+
+const log = (message: string, ...args: unknown[]) => {
+  console.error(`[MCP Dev] ${message}`, ...args)
+}
+
+type PermissionStat = { uid: number; mode: number }
+
+/**
+ * Resolve the project root by walking up from `startDir` to the nearest
+ * ancestor containing a project-root marker. Falls back to `startDir` (never
+ * the filesystem root) when no marker is found, so a planted `.mcp.json` in a
+ * writable ancestor such as `/tmp` can never be picked up.
+ */
+export function findProjectRoot(startDir: string, exists: (path: string) => boolean): string {
+  let dir = resolve(startDir)
+  while (true) {
+    for (const marker of PROJECT_ROOT_MARKERS) {
+      if (exists(resolve(dir, marker))) return dir
+    }
+    const parent = dirname(dir)
+    if (parent === dir) return resolve(startDir)
+    dir = parent
+  }
+}
+
+/**
+ * Validate the ownership and permissions of `.mcp.json` before its secret is
+ * read. Refuses when the file is owned by another user (a planted/shadowed
+ * config) and warns loudly when it is accessible to group/other (the key is a
+ * live secret). POSIX-only: when `currentUid` is null (e.g. Windows) the checks
+ * are skipped.
+ */
+export function checkMcpConfigPermissions(
+  configPath: string,
+  fileStat: PermissionStat,
+  currentUid: number | null,
+  warn: (message: string) => void,
+): { ok: boolean; reason?: string } {
+  if (currentUid === null) return { ok: true }
+  if (fileStat.uid !== currentUid) {
+    return {
+      ok: false,
+      reason: `refusing to read ${configPath}: it is owned by uid ${fileStat.uid}, not the current user (uid ${currentUid})`,
+    }
+  }
+  if ((fileStat.mode & 0o077) !== 0) {
+    warn(
+      `${configPath} is accessible to group/other (mode ${(fileStat.mode & 0o777).toString(8)}); it contains a live API key — restrict it with: chmod 600 ${configPath}`,
+    )
+  }
+  return { ok: true }
+}
+
+/**
+ * Resolve the dev MCP server's API key.
+ *
+ * Priority: `OPEN_MERCATO_API_KEY` env var, then `headers.x-api-key` from a
+ * single `.mcp.json` read from the detected project root. The lookup is bounded
+ * to the project root (it never walks up to the filesystem root), and the file
+ * is ownership/permission-checked before its secret is read.
+ */
+export async function getApiKeyFromMcpJson(): Promise<string | undefined> {
+  const envKey = process.env.OPEN_MERCATO_API_KEY
+  if (envKey && envKey.trim().length > 0) {
+    return envKey.trim()
+  }
+
+  const { readFile, stat } = await import('node:fs/promises')
+  const { existsSync } = await import('node:fs')
+
+  try {
+    const projectRoot = findProjectRoot(process.cwd(), existsSync)
+    const mcpJsonPath = resolve(projectRoot, MCP_CONFIG_FILENAME)
+    if (!existsSync(mcpJsonPath)) {
+      return undefined
+    }
+
+    const fileStat = await stat(mcpJsonPath)
+    const currentUid = typeof process.getuid === 'function' ? process.getuid() : null
+    const permissionCheck = checkMcpConfigPermissions(
+      mcpJsonPath,
+      { uid: fileStat.uid, mode: fileStat.mode },
+      currentUid,
+      (message) => log(`Warning: ${message}`),
+    )
+    if (!permissionCheck.ok) {
+      log(`Error: ${permissionCheck.reason}`)
+      return undefined
+    }
+
+    const content = await readFile(mcpJsonPath, 'utf-8')
+    const config = JSON.parse(content)
+    const serverConfig = config?.mcpServers?.['open-mercato']
+
+    return serverConfig?.headers?.['x-api-key']
+  } catch {
+    return undefined
+  }
+}

package/src/modules/ai_assistant/lib/mcp-dev-server.ts

@@ -7,6 +7,7 @@ import { executeTool } from './tool-executor'
 import { loadAllModuleTools, indexToolsForSearch } from './tool-loader'
 import { authenticateMcpRequest, extractApiKeyFromHeaders, hasRequiredFeatures } from './auth'
 import { jsonSchemaToZod } from './schema-utils'
+import { getApiKeyFromMcpJson } from './mcp-dev-key-resolution'
 import type { McpToolContext } from './types'
 import type { SearchService } from '@open-mercato/search/service'
 import type { RbacService } from '@open-mercato/core/modules/auth/services/rbacService'
@@ -17,42 +18,6 @@ const log = (message: string, ...args: unknown[]) => {
   console.error(`[MCP Dev] ${message}`, ...args)
 }
 
-async function getApiKeyFromMcpJson(): Promise<string | undefined> {
-  const { readFile, access } = await import('node:fs/promises')
-  const { resolve, dirname } = await import('node:path')
-
-  // Search for .mcp.json starting from cwd and walking up to project root
-  const findMcpJson = async (startDir: string): Promise<string | null> => {
-    let dir = startDir
-    const root = resolve('/')
-    while (dir !== root) {
-      const candidate = resolve(dir, '.mcp.json')
-      try {
-        await access(candidate)
-        return candidate
-      } catch {
-        dir = dirname(dir)
-      }
-    }
-    return null
-  }
-
-  try {
-    const mcpJsonPath = await findMcpJson(process.cwd())
-    if (!mcpJsonPath) {
-      return undefined
-    }
-
-    const content = await readFile(mcpJsonPath, 'utf-8')
-    const config = JSON.parse(content)
-    const serverConfig = config?.mcpServers?.['open-mercato']
-
-    return serverConfig?.headers?.['x-api-key']
-  } catch {
-    return undefined
-  }
-}
-
 /**
  * Maximum request body size (1MB).
  */

package/src/modules/ai_assistant/lib/mcp-server.ts

@@ -17,7 +17,14 @@ import type { RbacService } from '@open-mercato/core/modules/auth/services/rbacS
  * Create and configure an MCP server instance.
  */
 export async function createMcpServer(options: McpServerOptions): Promise<Server> {
-  const { config, container, context, apiKeySecret } = options
+  const { config, container, context, allowUnauthenticatedSuperadmin } = options
+
+  // Treat empty / whitespace-only secrets as missing so a blank api key cannot
+  // fall through into an unauthenticated branch.
+  const apiKeySecret =
+    typeof options.apiKeySecret === 'string' && options.apiKeySecret.trim().length > 0
+      ? options.apiKeySecret
+      : undefined
 
   let tenantId: string | null = null
   let organizationId: string | null = null
@@ -37,41 +44,48 @@ export async function createMcpServer(options: McpServerOptions): Promise<Server
     userFeatures = authResult.features
     isSuperAdmin = authResult.isSuperAdmin
     console.error(`[MCP Server] Authenticated via API key: ${authResult.keyName}`)
-  } else if (context) {
-    // Manual context provided
+  } else if (context && context.userId) {
+    // Manual context with a real user — load that user's ACL.
     tenantId = context.tenantId
     organizationId = context.organizationId
     userId = context.userId
 
-    if (userId) {
-      try {
-        const rbacService = container.resolve('rbacService') as {
-          loadAcl: (
-            userId: string,
-            scope: { tenantId: string | null; organizationId: string | null }
-          ) => Promise<{
-            isSuperAdmin: boolean
-            features: string[]
-          }>
-        }
-        const acl = await rbacService.loadAcl(userId, {
-          tenantId,
-          organizationId,
-        })
-        userFeatures = acl.features
-        isSuperAdmin = acl.isSuperAdmin
-      } catch (error) {
-        console.error('[MCP Server] Failed to load user ACL:', error)
+    try {
+      const rbacService = container.resolve('rbacService') as {
+        loadAcl: (
+          userId: string,
+          scope: { tenantId: string | null; organizationId: string | null }
+        ) => Promise<{
+          isSuperAdmin: boolean
+          features: string[]
+        }>
       }
-    } else {
-      // No user specified - grant superadmin access for development/testing
-      isSuperAdmin = true
-      console.error('[MCP Server] No user specified, running with superadmin access')
+      const acl = await rbacService.loadAcl(userId, {
+        tenantId,
+        organizationId,
+      })
+      userFeatures = acl.features
+      isSuperAdmin = acl.isSuperAdmin
+    } catch (error) {
+      console.error('[MCP Server] Failed to load user ACL:', error)
+    }
+  } else if (allowUnauthenticatedSuperadmin) {
+    // Explicit, loud dev/testing opt-in. Without a user there is no ACL to load,
+    // so the server runs as superadmin with no tenant scoping beyond whatever the
+    // caller pinned via `context`. NEVER enable this in production.
+    if (context) {
+      tenantId = context.tenantId
+      organizationId = context.organizationId
     }
-  } else {
-    // No context and no API key - superadmin for dev/testing
     isSuperAdmin = true
-    console.error('[MCP Server] No auth context, running with superadmin access')
+    console.error(
+      '[MCP Server] WARNING: allowUnauthenticatedSuperadmin is enabled — running with UNAUTHENTICATED SUPERADMIN access and no per-user ACL. Do not use this outside local development/testing.'
+    )
+  } else {
+    // Fail closed: refuse to start rather than silently escalating to superadmin.
+    throw new Error(
+      '[internal] MCP server refused to start: no authentication provided. Supply a valid apiKeySecret, a context with a non-empty userId, or explicitly set allowUnauthenticatedSuperadmin: true for local development.'
+    )
   }
 
   const toolContext: McpToolContext = {
@@ -200,14 +214,14 @@ export async function runMcpServer(options: McpServerOptions): Promise<void> {
 
   console.error(`[MCP Server] Starting ${options.config.name} v${options.config.version}`)
 
-  if (options.apiKeySecret) {
+  if (options.apiKeySecret && options.apiKeySecret.trim().length > 0) {
     console.error(`[MCP Server] Authentication: API key`)
-  } else if (options.context) {
+  } else if (options.context && options.context.userId) {
     console.error(`[MCP Server] Tenant: ${options.context.tenantId ?? '(none)'}`)
     console.error(`[MCP Server] Organization: ${options.context.organizationId ?? '(none)'}`)
-    console.error(`[MCP Server] User: ${options.context.userId ?? '(superadmin)'}`)
+    console.error(`[MCP Server] User: ${options.context.userId}`)
   } else {
-    console.error(`[MCP Server] Authentication: none (superadmin mode)`)
+    console.error(`[MCP Server] Authentication: none (unauthenticated superadmin opt-in)`)
   }
 
   console.error(`[MCP Server] Tools registered: ${toolCount}`)

package/src/modules/ai_assistant/lib/openai-compatible-presets.ts

@@ -12,7 +12,7 @@
  * file.
  *
  * @see ./llm-adapters/openai.ts
- * @see .ai/specs/2026-04-14-llm-provider-ports-and-adapters.md
+ * @see .ai/specs/implemented/2026-04-14-llm-provider-ports-and-adapters.md
  */
 
 import type { OpenAICompatiblePreset } from './llm-adapters/openai'

package/src/modules/ai_assistant/lib/task-plan-stream.ts

@@ -1,7 +1,7 @@
 /**
  * Visible AI chat agent task plan — server-side SSE injector.
  *
- * Spec: `.ai/specs/2026-05-13-ai-chat-visible-task-plan.md`.
+ * Spec: `.ai/specs/implemented/2026-05-13-ai-chat-visible-task-plan.md`.
  *
  * Wraps a streaming `Response` produced by `streamText().toUIMessageStreamResponse()`
  * (or the equivalent `ToolLoopAgent.stream(...).toUIMessageStreamResponse()`)

package/src/modules/ai_assistant/lib/types.ts

@@ -217,6 +217,13 @@ export interface McpServerOptions {
   }
   /** API key secret for authentication (alternative to manual context) */
   apiKeySecret?: string
+  /**
+   * Explicit, loud opt-in for running without authentication as a superadmin
+   * (development/testing only). When false/unset and no `apiKeySecret` or
+   * `context.userId` is supplied, the server fails closed and refuses to start
+   * instead of silently escalating to superadmin. NEVER enable in production.
+   */
+  allowUnauthenticatedSuperadmin?: boolean
 }
 
 /**

package/src/modules/ai_assistant/setup.ts

@@ -1,7 +1,16 @@
+import { createHash } from 'node:crypto'
 import type { ModuleSetupConfig } from '@open-mercato/shared/modules/setup'
 
-const PENDING_ACTION_CLEANUP_SCHEDULE_ID = 'ai_assistant:pending-action-cleanup'
-const TOKEN_USAGE_PRUNE_SCHEDULE_ID = 'ai_assistant:token-usage-prune'
+const PENDING_ACTION_CLEANUP_SCHEDULE_KEY = 'ai_assistant:pending-action-cleanup'
+const TOKEN_USAGE_PRUNE_SCHEDULE_KEY = 'ai_assistant:token-usage-prune'
+
+function stableScheduleUuid(stableKey: string): string {
+  const hex = createHash('sha256').update(stableKey).digest('hex')
+  return `${hex.slice(0, 8)}-${hex.slice(8, 12)}-${hex.slice(12, 16)}-${hex.slice(16, 20)}-${hex.slice(20, 32)}`
+}
+
+const PENDING_ACTION_CLEANUP_SCHEDULE_ID = stableScheduleUuid(PENDING_ACTION_CLEANUP_SCHEDULE_KEY)
+const TOKEN_USAGE_PRUNE_SCHEDULE_ID = stableScheduleUuid(TOKEN_USAGE_PRUNE_SCHEDULE_KEY)
 
 /**
  * System-scoped recurring schedule: every 5 minutes, enqueue a job to the